Data Description

The CDPOS event is used in SAP to view the change documents associated with changes to a business object in the SAP system.

Potential Use Cases

This event could be used in the following scenarios:

  • Identify and alert on changes, which could create compliance concerns

  • Dashboard and alert on total change volume for specific critical tables.

Metric Filters

Important Note: Data will not be extracted until the Metric Filter is configured.

Log into the managed system, and execute the /n/bnwvs/main transaction. Then go to Administrator → Metric filters → Change doc. filter.

Click on the New Entries button to add additional values. Define the filter header records by indicating Change document object, Transaction code, Description (wildcards are supported). Selection type should be “CDPOS table”. Save.

Then define the list of tables to select changes from by selecting filter header record and double-click on ‘Tables to select from’ node on the left panel.

Key field name and ‘Is master’ fields should be empty/ignored. Active flag should be set, otherwise table will be ignored at run time. 

For each table it is possible to define list of fields to be extracted (wildcards are supported). Add the desired entries by selecting the New Entries button, and enter the desired parameters. Highlight the table of interest and double-click on the “Field values to get” option.

Click the New Entries button and add new field values.

Save all settings.

Splunk Event

CDPOS with EVENT_SUBTYPE=””

Important Note: Data will not be extracted until the Metric Filter is configured.

The event will look like this in Splunk:

CDPOS with EVENT_SUBTYPE=”CDPOS”

Important Note: Data will not be extracted until the Metric Filter is configured.

The event will look like this in Splunk:

SAP Navigation

CDPOS with EVENT_SUBTYPE=””

Important Note: Data will not be extracted until the Metric Filter is configured.

Log into the managed system, and execute the SE16 transaction code. Then enter CDPOS in the Table Name field, and hit the Enter key.

Then enter the desired user selection parameters, and hit the Execute button.

The information displayed will match the data that is extracted and sent to Splunk.

CDPOS with EVENT_SUBTYPE=”CDPOS”

Important Note: Data will not be extracted until the Metric Filter is configured.

Log into the managed system, and execute the SE16 transaction code. Then enter CDPOS in the Table Name field, and hit the Enter key.

Then enter the desired user selection parameters, and hit the Execute button.

The information displayed will match the data that is extracted and sent to Splunk.

Field Mapping

CDPOS with EVENT_SUBTYPE=””

Field

Description

Unit of Measure

ACT_CHNGNO

Change number of the document created by this change

Number

CHANGENR

Document change number

Number

CHANGE_IND

Application object change type (U, I, E, D)

String

CURRENT_TIMESTAMP

The date time stamp when the information was collected

YYYYMMDDHHMMSS

EVENT_SUBTYPE

String

EVENT_TYPE

CDPOS

String

LANGU

Language Key

String

OBJECTCLAS

Object class

String

OBJECTID

Object value

Number

PLANCHNGNR

Planned change number

Number

TCODE

Transaction in which a change was made

String

UDATE

Creation date of the change document

YYYYMMDD

USERNAME

User name of the person responsible in change document

String

UTCDIFF

The UTC OFFSSET in HHMMSS that the data was collected in

HHMMSS

UTCSIGN


The UTC positive or negative OFFSET indicator. Positive (+) means add UTCDIFF to find the time zone of the data, negative (-) means subtract the UTCDIFF to find the time zone adjusted date time the data was collected in.

+ | -

UTIME

Time changed

HHMMSS

VERSION

3-Byte field

Number

WAS_PLANND

Flag that changes were generated from planned changes

Boolean

CDPOS with EVENT_SUBTYPE=”CDPOS”

Field

Description

Unit of Measure

CHANGENR

Document change number

Number

CHNGIND

Change Type (U, I, S, D)

String

CURRENT_TIMESTAMP

The date time stamp when the information was collected

YYYYMMDDHHMMSS

EVENT_SUBTYPE

CDPOS

String

EVENT_TYPE

CDPOS

String

EXT_KEYLEN

Table key length

Number

FNAME

Field Name

String

FTEXT

Explanatory short text

String

F_NEW

New contents of changed field

String

F_OLD

Old contents of changed field

String

KEYGUID

KEYGUID for Link to CDPOS_UID

Integer

KEYGUID_STR

KEYGUID for Link to CDPOS_STR

Integer

KEYLEN

Table key length

Number

OBJECTID

Object value

String

OUTLEN

Output length of the old and new value

Number

SPRACHE

Language Key

String

TABKEY

Changed table record key

Number

TABKEY254

Table Key for CDPOS in Character 254

Number

TABNAME

Change document creation: Table name

String

TCODE

Transaction in which a change was made

STring

TEXTART

Create change document: Text type

String

TEXT_CASE

Text change flag ('X')

Boolean

UDATE

Creation date of the change document

YYYYMMDD

USERNAME

User name of the person responsible in change document

String

UTCDIFF

The UTC OFFSSET in HHMMSS that the data was collected in

HHMMSS

UTCSIGN

The UTC positive or negative OFFSET indicator. Positive (+) means add UTCDIFF to find the time zone of the data, negative (-) means subtract the UTCDIFF to find the time zone adjusted date time the data was collected in.

+ | -

UTIME

Time changed

HHMMSS